---
id: "CVE-2026-76954"
page: "https://infrastack.ai/live/CVE-2026-76954"
kind: "vulnerability"
aliases: ["CVE-2026-76954"]
title: "Synology DSM: SQL injection in Auth API lets remote attackers read and write files"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Synology DiskStation Manager", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dsm", "nas", "self-hosted", "synology", "vendor"]
not_affected_if: ["dsm-already-patched"]
published_at: "2026-11-12T04:17:20+00:00"
first_seen_at: "2026-11-12T04:47:09+00:00"
updated_at: "2026-11-12T04:47:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76954", "first_seen_at": "2026-11-12T04:47:09+00:00"}]
exploit_sources: []
---

# Synology DSM: SQL injection in Auth API lets remote attackers read and write files

Link for people: https://infrastack.ai/live/CVE-2026-76954 (this .md is for agents)

Synology DiskStation Manager has an SQL injection flaw in its Auth API that lets remote attackers read or write arbitrary files and cause denial of service. The NVD score is 9.8 critical.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Synology DiskStation Manager affected range not listed fixed no fixed version listed

## How to check

- Open DSM and check the installed version under Control Panel > Info Center; compare it with the fixed versions listed below.

## Fix

- DSM `7.2.1-69057-13` or later on the 7.2.1 branch
- DSM `7.2.2-72806-10` or later on the 7.2.2 branch
- DSM `7.3.2-86009-5` or later on the 7.3.2 branch
- DSM `7.4.1-90080-1` or later on the 7.4.1 branch

## Timeline

- 2026-11-12T04:47:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76954

## From the sources

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_